formbook | 25439bd1af262e2afc1fffd901a00d423a77b1da0a6b5c23302e4744b5e0116a

General

Target

online_pdf.com.exe
Size

491KB
MD5

3cdbec5b22be037209b38ea585de4a50
SHA1

f904a637406954b6d613152a0bbebfccc514dc3e
SHA256

25439bd1af262e2afc1fffd901a00d423a77b1da0a6b5c23302e4744b5e0116a
SHA512

da8fe366ca35b4eea7c998e0456baa6a5bff1cdca014564e0803823b89bfa5c55206e7f83dbfb6b8e38963ff194e9454001ac00c91cdd37c47801b17ce1aae96

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/672-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/672-58-0x000000000041F200-mapping.dmp	formbook
behavioral1/memory/1632-66-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1816 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

online_pdf.com.exe

pid process

320 online_pdf.com.exe

pid	process
1816	cmd.exe

pid	process
320	online_pdf.com.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

online_pdf.com.exeonline_pdf.com.execontrol.exe

description	pid	process	target process
PID 320 set thread context of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 672 set thread context of 1380	672	online_pdf.com.exe	Explorer.EXE
PID 1632 set thread context of 1380	1632	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

online_pdf.com.execontrol.exe

pid	process
672	online_pdf.com.exe
672	online_pdf.com.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe
1632	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

online_pdf.com.execontrol.exe

pid process

672 online_pdf.com.exe
672 online_pdf.com.exe
672 online_pdf.com.exe
1632 control.exe
1632 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

online_pdf.com.execontrol.exe

description pid process

Token: SeDebugPrivilege 672 online_pdf.com.exe
Token: SeDebugPrivilege 1632 control.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE

pid	process
1380	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	672	online_pdf.com.exe
Token: SeDebugPrivilege	1632	control.exe

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

online_pdf.com.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 320 wrote to memory of 672	320	online_pdf.com.exe	online_pdf.com.exe
PID 1380 wrote to memory of 1632	1380	Explorer.EXE	control.exe
PID 1380 wrote to memory of 1632	1380	Explorer.EXE	control.exe
PID 1380 wrote to memory of 1632	1380	Explorer.EXE	control.exe
PID 1380 wrote to memory of 1632	1380	Explorer.EXE	control.exe
PID 1632 wrote to memory of 1816	1632	control.exe	cmd.exe
PID 1632 wrote to memory of 1816	1632	control.exe	cmd.exe
PID 1632 wrote to memory of 1816	1632	control.exe	cmd.exe
PID 1632 wrote to memory of 1816	1632	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe
"C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:320

C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe
"C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\online_pdf.com.exe"
3⤵
- Deletes itself
PID:1816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsnE956.tmp\apqan.dll
MD5
3fd39c9847bb4b594952834b7fdf24e6

SHA1
96f52b1cc8dc965984063b745b801d3bba95ff27

SHA256
5f16dc9d03fc218e2ec3bbe921603f5aab9377747f6bb7440435e56f6dbde816

SHA512
3a899c04bf6cebd9ac495941cb82a37bfc6789eb073a4a9b31602213542d6e7f66111ddf4d9970fba8149a1e9adf8aea6f272e7716b3f23d67beafd677d38305

Download Submit
memory/320-55-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download
memory/672-62-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/672-58-0x000000000041F200-mapping.dmp

Download
memory/672-60-0x0000000000800000-0x0000000000B03000-memory.dmp

Filesize
3.0MB

Download
memory/672-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1380-61-0x0000000006D30000-0x0000000006E8F000-memory.dmp

Filesize
1.4MB

Download
memory/1380-70-0x00000000043A0000-0x000000000445F000-memory.dmp

Filesize
764KB

Download
memory/1632-63-0x0000000000000000-mapping.dmp

Download
memory/1632-65-0x00000000000D0000-0x00000000000EF000-memory.dmp

Filesize
124KB

Download
memory/1632-66-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1632-68-0x0000000002050000-0x0000000002353000-memory.dmp

Filesize
3.0MB

Download
memory/1632-69-0x0000000001E20000-0x0000000001EB4000-memory.dmp

Filesize
592KB

Download
memory/1816-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads